SealShare/tests/Feature/SecurityAuditTest.php

<?php

use App\Livewire\Admin\AdminSettings;
use App\Livewire\FileUploader;
use App\Livewire\ShareDownload;
use App\Models\Setting;
use App\Models\Share;
use App\Models\ShareFile;
use App\Models\User;
use App\Services\ShareService;
use Illuminate\Contracts\Hashing\Hasher;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Facades\Storage;
use Livewire\Features\SupportLockedProperties\CannotUpdateLockedPropertyException;
use Livewire\Livewire;

// --- Session stores derived key, not plaintext password ---

test('session stores derived encryption key instead of plaintext password', function () {
    Storage::fake('shares');

    $service = app(ShareService::class);
    $file = UploadedFile::fake()->create('file.txt', 100);

    $share = $service->createShare([
        ['file' => $file, 'relativePath' => null],
    ], [
        'password' => 'test-password-secure',
    ]);

    Livewire::test(ShareDownload::class, ['share' => $share])
        ->set('password', 'test-password-secure')
        ->call('verifyPassword');

    expect(session('share_key_'.$share->token))->not->toBeNull();
    expect(session('share_key_'.$share->token))->not->toBe('test-password-secure');
    expect(strlen(session('share_key_'.$share->token)))->toBe(64);
});

// --- The password gate cannot be opened from the browser ---

test('a visitor without the password cannot unlock a share\'s file list from the browser', function () {
    Storage::fake('shares');

    $share = app(ShareService::class)->createShare([
        ['file' => UploadedFile::fake()->createWithContent('salary-review.pdf', 'secret'), 'relativePath' => null],
    ], [
        'password' => 'test-password-secure',
    ]);

    Livewire::test(ShareDownload::class, ['share' => $share])
        ->assertDontSee('salary-review.pdf')
        ->set('authenticated', true);
})->throws(CannotUpdateLockedPropertyException::class);

// --- Rate limiting on password verification ---

test('rate limiting blocks after 5 failed password attempts', function () {
    Storage::fake('shares');

    $service = app(ShareService::class);
    $file = UploadedFile::fake()->create('file.txt', 100);

    $share = $service->createShare([
        ['file' => $file, 'relativePath' => null],
    ], [
        'password' => 'correct-password',
    ]);

    $component = Livewire::test(ShareDownload::class, ['share' => $share]);

    for ($i = 0; $i < 5; $i++) {
        $component->set('password', 'wrong-password')
            ->call('verifyPassword')
            ->assertHasErrors(['password']);
    }

    $component->set('password', 'correct-password')
        ->call('verifyPassword')
        ->assertHasErrors(['password'])
        ->assertSet('authenticated', false);
});

test('rate limiter clears after successful password verification', function () {
    Storage::fake('shares');

    $service = app(ShareService::class);
    $file = UploadedFile::fake()->create('file.txt', 100);

    $share = $service->createShare([
        ['file' => $file, 'relativePath' => null],
    ], [
        'password' => 'correct-password',
    ]);

    $component = Livewire::test(ShareDownload::class, ['share' => $share]);

    $component->set('password', 'wrong-password')
        ->call('verifyPassword')
        ->assertHasErrors(['password']);

    $component->set('password', 'correct-password')
        ->call('verifyPassword')
        ->assertSet('authenticated', true);

    $rateLimitKey = 'share-password:'.$share->token.'|127.0.0.1';
    expect(RateLimiter::remaining($rateLimitKey, 5))->toBe(5);
});

test('a share password attempt is counted before the password is checked', function () {
    Storage::fake('shares');

    $share = app(ShareService::class)->createShare([
        ['file' => UploadedFile::fake()->create('file.txt', 100), 'relativePath' => null],
    ], [
        'password' => 'correct-password',
    ]);

    $ipKey = 'share-password:'.$share->token.'|127.0.0.1';
    $attemptsSeenDuringCheck = new ArrayObject;

    Hash::swap(new class(Hash::getFacadeRoot(), $ipKey, $attemptsSeenDuringCheck) implements Hasher
    {
        public function __construct(private Hasher $inner, private string $ipKey, private ArrayObject $seen) {}

        public function info($hashedValue): array
        {
            return $this->inner->info($hashedValue);
        }

        public function make(#[SensitiveParameter] $value, array $options = []): string
        {
            return $this->inner->make($value, $options);
        }

        public function check(#[SensitiveParameter] $value, $hashedValue, array $options = []): bool
        {
            $this->seen[] = RateLimiter::attempts($this->ipKey);

            return $this->inner->check($value, $hashedValue, $options);
        }

        public function needsRehash($hashedValue, array $options = []): bool
        {
            return false;
        }
    });

    Livewire::test(ShareDownload::class, ['share' => $share])
        ->set('password', 'wrong-password')
        ->call('verifyPassword');

    expect($attemptsSeenDuringCheck->getArrayCopy())->not->toBeEmpty()
        ->each->toBeGreaterThanOrEqual(1);
});

test('the share-wide limit refuses the correct password from any address', function () {
    Storage::fake('shares');

    $share = app(ShareService::class)->createShare([
        ['file' => UploadedFile::fake()->create('file.txt', 100), 'relativePath' => null],
    ], [
        'password' => 'correct-password',
    ]);

    for ($i = 0; $i < 20; $i++) {
        RateLimiter::hit('share-password:'.$share->token, 60);
    }

    Livewire::test(ShareDownload::class, ['share' => $share])
        ->set('password', 'correct-password')
        ->call('verifyPassword')
        ->assertHasErrors(['password'])
        ->assertSee('Too many attempts')
        ->assertSet('authenticated', false);
});

// --- The system password gate holds for Livewire updates ---

test('a file uploader snapshot from before the system password was set cannot register files in an unverified session', function () {
    Storage::fake('shares');

    preg_match_all('/wire:snapshot="([^"]+)"/', $this->get(route('upload'))->assertOk()->getContent(), $matches);
    $snapshot = collect($matches[1])
        ->map(fn (string $raw): array => json_decode(htmlspecialchars_decode($raw, ENT_QUOTES), true))
        ->first(fn (array $snapshot): bool => str_contains($snapshot['memo']['name'] ?? '', 'file-uploader'));
    expect($snapshot)->not->toBeNull();

    Setting::set('system_password', Hash::make('system-secret'));
    $this->flushSession();

    $response = $this->withHeaders(['X-Livewire' => '1'])
        ->postJson(app('livewire')->getUpdateUri(), [
            'components' => [[
                'snapshot' => json_encode($snapshot),
                'updates' => [],
                'calls' => [['method' => 'registerFiles', 'params' => [[['name' => 'file.bin', 'size' => 1024]]], 'path' => '']],
            ]],
        ]);

    $response->assertRedirect(route('system-password'));
    expect(Share::query()->count())->toBe(0);
});

// --- Share password minimum length ---

test('share password must be at least 8 characters', function () {
    Storage::fake('shares');

    Livewire::test(FileUploader::class)
        ->set('usePassword', true)
        ->set('password', 'short')
        ->call('createShare')
        ->assertHasErrors(['password' => 'min']);
});

test('share password of 8 characters is accepted', function () {
    Storage::fake('shares');

    Livewire::test(FileUploader::class)
        ->set('usePassword', true)
        ->set('password', 'longenough')
        ->call('createShare')
        ->assertHasNoErrors(['password']);
});

// --- is_admin not mass assignable ---

test('is_admin is not mass assignable on User model', function () {
    $user = User::query()->create([
        'name' => 'Test User',
        'email' => 'mass-assign-test@example.com',
        'password' => bcrypt('password'),
        'is_admin' => true,
    ]);

    expect($user->is_admin)->toBeFalsy();
});

// --- Setup wizard guard prevents duplicate admins ---

test('setup wizard createAdmin is blocked when admin already exists', function () {
    $adminCountBefore = User::query()->where('is_admin', true)->count();

    $this->post(route('setup'), [
        'name' => 'Second Admin',
        'email' => 'second-admin@example.com',
        'password' => 'password123',
        'password_confirmation' => 'password123',
    ]);

    expect(User::query()->where('email', 'second-admin@example.com')->exists())->toBeFalse();
    expect(User::query()->where('is_admin', true)->count())->toBe($adminCountBefore);
});

// --- Content-Disposition sanitization ---

test('content disposition handles special characters in filename', function () {
    Storage::fake('shares');

    $share = app(ShareService::class)->createShare([
        ['file' => UploadedFile::fake()->createWithContent('normal.txt', 'test content'), 'relativePath' => null],
    ]);
    $shareFile = $share->files->first();
    $shareFile->update(['original_name' => 'file"with"quotes.txt']);

    $response = $this->get(route('share.download.file', [$share, $shareFile]));

    expect($response->headers->get('Content-Disposition'))
        ->toContain('attachment')
        ->not->toContain('file"with"quotes.txt');
});

// --- SVG upload rejected ---

test('svg upload is rejected for site logo', function () {
    $admin = User::query()->where('is_admin', true)->first();

    Livewire::actingAs($admin)
        ->test(AdminSettings::class)
        ->set('maxFileSize', 100)
        ->set('siteLogo', UploadedFile::fake()->create('logo.svg', 100, 'image/svg+xml'))
        ->call('saveSettings')
        ->assertHasErrors(['siteLogo']);
});

// --- Relative path validation (Zip Slip prevention) ---

test('relative paths from a dropped folder that could reach outside the share are dropped', function (string $relativePath) {
    Storage::fake('shares');

    Livewire::test(FileUploader::class)
        ->call('registerFiles', [['name' => 'file.txt', 'size' => 100, 'path' => $relativePath]]);

    expect(ShareFile::query()->sole()->relative_path)->toBeNull();
})->with([
    'directory traversal' => '../../etc/passwd',
    'absolute path' => '/etc/passwd',
    'windows traversal' => '..\\..\\windows\\system.ini',
]);

test('valid relative paths are preserved', function () {
    Storage::fake('shares');

    Livewire::test(FileUploader::class)
        ->call('registerFiles', [['name' => 'file.txt', 'size' => 100, 'path' => 'folder/subfolder/file.txt']]);

    expect(ShareFile::query()->sole()->relative_path)->toBe('folder/subfolder/file.txt');
});

// --- Security headers ---

test('security headers are present on responses', function () {
    $response = $this->get(route('upload'));

    $response->assertHeader('X-Content-Type-Options', 'nosniff');
    $response->assertHeader('X-Frame-Options', 'DENY');
    $response->assertHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
    $response->assertHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
});

// --- Token collision retry ---

test('share service generates unique tokens', function () {
    Storage::fake('shares');

    $service = app(ShareService::class);

    $shares = [];
    for ($i = 0; $i < 5; $i++) {
        $file = UploadedFile::fake()->create("file{$i}.txt", 100);
        $shares[] = $service->createShare([
            ['file' => $file, 'relativePath' => null],
        ]);
    }

    $tokens = array_map(fn ($s) => $s->token, $shares);
    expect(array_unique($tokens))->toHaveCount(5);
});